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REMARKS 

This Application has been carefully reviewed in light of the Office Action 
electronically mailed October 28, 2009. At the time of the Office Action, Claims 1-5, 7-10, 
12-21, 23-26, 28-37, 39-42, and 44-60 were currently pending. Claims 1-5, 7-10, 12-21, 23- 
26, 28-37, 39-42, and 44-55 have been allowed. Claims 56-60 have been rejected. 
Applicants amend Claims 33-37, 39-42, 44-48, and 54-55. Applicants respectfully request 
reconsideration and allowance of all pending claims. 

Allowed Claims 

Applicants appreciate the Examiner's allowance of Claims 1-5, 7-10, 12-21, 23-26, 
28-37, 39-42, and 44-55. 

Section 101 Rejections 

The Office Action provides conflicting statements with regard to what claims, if any, 
are rejected under 35 U.S.C. § 101. The Disposition of Claims in the Office Action Summary 
specifies that Claim 33 has been allowed, and the Office Action further states that the 
rejection of Claim 33 under 35 U.S.C. § 101 has been withdrawn. See Office Action 
Summary; See Office Action, page 2. However, the Office Action also states that the 
rejections under 35 U.S.C. § 101 with respect to Claims 33-37, 39-42, 44-48, and 54-55 have 
been maintained. Applicants respond under the assumption that the Office Action intended to 
maintain the rejection of Claims 33-37, 39-42, 44-48, and 54-55 under 35 U.S.C. § 101 as 
being directed to non-statutory subject matter. Applicants respectfully traverse these 
rejections. 

Claim 33 recites a tangible program storage device and the Office Action states that 
the mere recitation of the word tangible in front of storage medium does not overcome a 
rejection under 35 U.S.C. § 101. See Office Action, page 3. According to the M.P.E.P., 
when functional descriptive material consisting of data structures and computer programs is 
recorded on some computer-readable medium, it becomes structurally and functionally 
interrelated to the medium and will be statutory in most cases. See M.P.E.P. § 2106.01. 
Because Claim 33 recites a tangible program storage device that includes computer 
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executable code, Applicants respectfully submit that Claim 33 is patentable under 35 U.S.C. 
§ 101. 

The Office Action also objects to Claim 33 for failing to provide an antecedent basis 
for the term storage medium in the specification. See Office Action, page 3. Applicants 
amend Claim 33 to recite a "program storage device" as suggested by the Examiner. 
Applicants respectfully request withdrawal of the rejections. 

Claims 34-37, 39-42, 44-48, and 54-55 depend, either directly or indirectly, on Claim 
33. Thus, for the reasons discussed with respect to Claim 33, Applicants respectfully submit 
that Claims 34-37, 39-42, 44-48, and 54-55 are patentable under 35 U.S.C. § 101. Applicants 
respectfully request that the rejections of Claims 33-37, 39-42, 44-48, and 54-55 be 
withdrawn. 

Section 103 Rejections 

The Office Action rejects Claims 56-60 under 35 U.S.C. § 103(a) as being 
unpatentable over U.S. Patent Publication No. 2004/0123117 issued to Berger ("Berger") in 
view of U.S. Patent No. 7,539,664 issued to Dutta, et al. ("Dutta"). Applicants respectfully 
traverse these rejections. 

Claim 56 recites adding the entry for the file to a database of known good software if 
the quantitative information exceeds a predetermined value. The Office Action states that 
Berger teaches adding an entry to a database of known good software if the quantitative 
information exceeds a predetermined value. See Office Action, pages 2, 4-5. Berger actually 
discloses monitoring an application in a sandbox to determine if the application is safe, and 
updating a local configuration to reflect that a potentially unsafe application is now a known 
safe application. See Berger, pars. [0074], [0081]. Thus, Berger uses the behavior of the 
application in a sandbox to decide if an application is safe, rather than comparing quantitative 
information with a predetermined value. The Office Action argues that Berger compares 
quantitative information with a predetermined value because Berger determines an 
application is safe if the amount of time spent in a sandbox is above a predetermined amount 
of time. See Office Action, pages 2-3. However, Berger never makes a determination that an 
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application is safe based on the amount of time spent in the sandbox. Berger monitors the 
application in the sandbox to determine if the application violates a set of defined rules. See 
Berger, par. [0075]. Thus, Berger fails to disclose adding the entry for the file to a database 
of known good software if the quantitative information exceeds a predetermined value. 

Moreover, Claim 56 recites determining quantitative information regarding the file 
and adding the entry for the file to a database of known good software if the quantitative 
information exceeds a predetermined value. In rejecting Claim 56, the Office Action states 
that it would have been obvious to one of ordinary skill in the art to modify the computer 
security teachings of Berger to use the quantitative information taught in Dutta. See Office 
Action, page 5. However, this proposed Berger-Dutta combination is not obvious. Berger 
discloses updating a local configuration to reflect that a potentially unsafe application is now 
a known safe application, and Dutta discloses enhancing the search features of a peer-to-peer 
network by determining information regarding a file, such as the number of times the file was 
opened or executed, and using this information for rating the popularity of the file. See 
Berger, par. [0081]; See Dutta, col. 9, lines 34-49. The use of information regarding a file for 
rating the popularity of the file in Dutta bears no relation to computer security or detecting 
malicious software. The Office Action states the motivation for the combination would be to 
improve the malicious computer code detection of Dutta, See Office Action, page 5. 
However, Dutta relates only to improving performance of peer-to-peer file sharing networks. 
The portion of Dutta cited by the Office Action in reliance on this position discloses nothing 
about malicious computer code detection. See Dutta, col. 1, lines 5-10. Thus, Applicants 
respectfully submit that it would not have been obvious to one of ordinary skill in the art to 
combine the computer-security teachings of Berger to use the file information taught in 
Dutta. 

Because the Berger-Dutta combination fails to disclose every element of Claim 56 
and because there is no proper motivation to combine the references in the manner suggested, 
Applicants respectfully submit that Claim 56 is allowable over the cited art used in the 
rejections. Claims 57-60 depend, either directly or indirectly, on Claim 56. Thus, for at least 
the reasons discussed above with respect to Claim 56, Applicants respectfully request that the 
rejections of Claims 56-60 be withdrawn. 
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Conclusion 



Applicant has made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other apparent reasons, Applicant respectfully requests full 
allowance of all pending Claims. If the Examiner feels that a telephone conference or an 
interview would advance prosecution of this Application in any manner, the undersigned 
attorney for Applicant stands ready to conduct such a conference at the convenience of the 
Examiner. 

Although Applicant believes no fee is due, the Commissioner is hereby authorized to 
charge any required fee or credit any overpayment to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 



Attorneys for Applicant 




Chad C. Walters 
Reg. No. 48,022 
Phone: (214)953-6511 



Date: January 28, 2010 
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